This DPA forms part of the Master Terms of Service between PLMMarket Inc. (“Processor”) and the Customer (“Controller”) governing use of the Services.
Processor shall process Customer Personal Data only on documented instructions from Controller, including with respect to international transfers.
Processor ensures personnel are bound by confidentiality obligations and receive privacy and security training.
Processor maintains appropriate technical and organizational measures, including encryption in transit, access controls, logging, vulnerability management, and incident response procedures.
Where required, the parties incorporate the EU Commission Standard Contractual Clauses (Module 2) and UK IDTA/Addendum, as applicable.
Processor shall provide reasonable assistance for data subject requests, DPIAs, and consultations with Supervisory Authorities, taking into account the nature of processing and available information.
Processor will notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and provide information reasonably required for compliance.
Upon termination or at Controller’s written request, Processor shall delete or return Customer Personal Data except where retention is required by law or for limited audit logs (e.g., financial and provenance records).
Processor shall make available SOC/ISO reports or other audit materials. On-site audits may be conducted no more than annually with reasonable notice and confidentiality protections.
As set forth in the Master Terms (Delaware law and venue), subject to the liability limitations therein.
Privacy & data requests: privacy@plmmarket.com. Legal notices: legal@plmmarket.com.
